1. Scope and Compliance
This Privacy Policy applies to all personal data collected, stored, used, disclosed, and/or transferred by SoYang, operating as a strategic advisory consultancy.
Our policy is designed to comply with the Singapore Personal Data Protection Act (PDPA) and internationally recognized data privacy principles such as the GDPR, ensuring client and personnel data is handled with Integrity and Care.
2.Personal Data Collected
We collect personal data that is reasonably necessary to provide our consulting and legal advisory services. This falls into three main categories:
|
Category |
Data Collected |
Purposes |
|
Client Data |
Names, titles, job roles, corporate email addresses, corporate phone numbers, company name, LinkedIn profiles. |
Client relationship management, service delivery, invoicing, and direct marketing (example, newsletters). |
|
Service Data |
Data related to the services provided (example, contracts, corporate structure details, M&A documents). |
To perform the contracted service. This data is typically confidential business data, but may contain personal data of employees/directors. |
|
Personal / Consultant Data |
Resumes, employment or engagement history, banking details for payment, and performance records. |
Talent acquisition, contract management, payroll processing, and regulatory compliance. |
3.Purpose of Data Collection and Use
Personal data is collected and used only for the following explicit purposes:
(a) Service Delivery: To fulfil contractual obligations and provide strategic advice and legal consultancy services.
(b) Relationship Management: To manage the ongoing business relationship, including communication, service updates, and NPS feedback.
(c) Billing and Administration: For invoicing, fee collection, and other necessary financial and administrative tasks.
(d) Marketing (with Consent): To send newsletters, market insights, and thought leadership content based on the subscriber’s explicit consent.
(e) Compliance: To meet any legal, statutory, or regulatory obligations.
4.Disclosures and Transfer of Personal Data
SoYang Advisory does not sell personal data to third parties. Data is disclosed only on a need-to-know basis and under strict confidentiality agreements.
(a) To Consultants: Data is shared with fractional consultants and staff only to the extent necessary for them to perform their assigned scope of work, subject to the Offboarding Rules and NDA.
(b) To Third-Party Vendors: Data may be shared with approved service providers (example, secure cloud storage, CRM system, accounting software) who are obligated to adhere to equivalent privacy standards.
(c) Cross-Border Transfer: If data must be transferred outside of Singapore (example, for secure cloud backup), SoYang will ensure that the receiving jurisdiction has a comparable level of data protection, or we will implement appropriate contractual safeguards.
5.Data Security and Retention
(a) Reasonable Security Measures: We implement rigorous administrative, physical, and technical safeguards, including encryption, MFA and restricted access controls, to protect personal data from unauthorized access, loss, or disclosure.
(b) Retention: Personal data will be retained only for as long as it is necessary for the fulfilment of the purposes for which it was collected, or as required by law. Data is then securely destroyed or anonymized.
6.Individual Rights
Individuals have the right to:
(a) Access: Request a copy of their personal data held by SoYang Advisory.
(b) Correction: Request correction of any inaccurate or incomplete data.
(c) Withdrawal of Consent: Withdraw consent for the collection, use, or disclosure of their personal data at any time (example, unsubscribing from the newsletter).
7.Data Protection Officer
The Chief Legal and Risk Officer serves as the Data Protection Officer (DPO) for SoYang Advisory and is the point of contact for all data privacy inquiries, complaints, and requests.
(a) Business Contact Information:
Jasmine Foong, DPO, jasmine.foong@soyangadvisory.com
(b) Rights of Individuals: All requests for access, correction, or withdrawal of consent will be processed within 30 days of receiving the written request.
